CVE-2024-2450: High severity mattermost vulnerability

Q: What is the severity of CVE-2024-2450?

CVE-2024-2450 has been rated as a high severity vulnerability due to the potential for account takeover.

Q: How do I fix CVE-2024-2450?

To mitigate CVE-2024-2450, upgrade Mattermost to version 8.1.10, 9.2.6, 9.3.2, or 9.4.3 or newer.

Q: What is the impact of CVE-2024-2450 on Mattermost?

CVE-2024-2450 allows an authenticated attacker to take over other user accounts by exploiting improper account ownership verification.

Q: Which versions of Mattermost are affected by CVE-2024-2450?

Mattermost versions prior to 8.1.10, 9.2.6, 9.3.2, and 9.4.3 are affected by CVE-2024-2450.

Q: Is CVE-2024-2450 a critical vulnerability?

Yes, CVE-2024-2450 is considered critical because it enables unauthorized access to user accounts.

Published Mar 15, 2024

Updated

Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to SAML authentication, allowing an authenticated attacker to take over other user accounts via a crafted switch request under specific conditions.

Affected Software

5 affected components

Mattermost Mattermost Server>=8.1.0<8.1.10

Mattermost Mattermost Server>=9.2.0<9.2.6

Mattermost Mattermost Server>=9.3.0<9.3.2

Mattermost Mattermost Server>=9.4.0<9.4.3

Mattermost Mattermost Server=9.5.0

Remediation

Information

Update Mattermost Server to versions 9.6, 9.4.3, 9.5.1, 9.3.2, 9.2.6, 8.1.10 or higher.

Event History

Mar 15, 2024

CVE Published

via MITRE·09:12 AM

Data Sourced

via MITRE·09:12 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-2450?

CVE-2024-2450 has been rated as a high severity vulnerability due to the potential for account takeover.

How do I fix CVE-2024-2450?